KR100714113B1 - Customer edge apparatus, provider edge apparatus for layer 2 virtual private network service and the method thereof - Google Patents

Abstract

A subscriber edge device, a provider edge device, and a layer 2 virtual private network service establishment method of a layer 2 virtual private network service are disclosed. The subscriber edge device transmits a message requesting the establishment of a virtual private network according to a user input to a provider edge device and receives a first response message for the message from the provider edge device. A signal processor; And a system controller configured to set a two-layer interface for the virtual private network according to the configuration information included in the received first response message. According to the present invention, a virtual private network is automatically set up for a subscriber's desired virtual private network setting, and the subscriber can utilize a virtual private network service of a desired quality for a desired time, and the virtual private network service provider can also virtualize according to the subscriber's request. The private network is set up automatically, reducing the administrative cost of changing virtual private network services.

Description

{Customer edge apparatus, provider edge apparatus for layer 2 virtual private network service and the method}

1 is a diagram illustrating the concept of a virtual private network.

2 is a diagram illustrating a concept of tunneling for a virtual private network.

3 is a diagram conceptually representing a virtual private network service.

4A is a diagram illustrating a two-layer information negotiation process performed at each edge device.

4B is a diagram for explaining a data forwarding process performed in PE1 and PE2.

FIG. 5 is a diagram illustrating a conventional two-layer virtual private dedicated service centered on a network service provider.

6 is a block diagram showing the configuration of subscriber edge equipment and provider edge equipment according to an embodiment of the present invention.

7A and 7B are diagrams illustrating an operation flow according to a setup request and a release request of a virtual private network service according to an embodiment of the present invention.

FIG. 8A illustrates an operation and control of a service request unit of the subscriber edge equipment of FIG. 6.

8B is a diagram illustrating operation and control of the provider edge equipment of FIG. 6.

9A and 9B are flowcharts illustrating operations of a layer 2 virtual private network setting method according to an embodiment of the present invention.

The present invention relates to an MPLS-based two-layer virtual private network, and more particularly, to an apparatus and method for establishing a virtual private network according to a subscriber's request.

A virtual private network service is a service that connects remotely separated remote locations. In the past, ATM, Frame Relay based leased line service was provided to interconnect networks between remote sites. Recently, however, service providers have prepared new alternatives to the concept of dedicated services for virtual private networks. This is because the existing leased line service has no flexibility in providing bandwidth to customers. That is, once the dedicated line is allocated, the bandwidth may be too low for the customer, or the bandwidth may be too large than necessary, and thus, the limitation of the allocated bandwidth is not free. Service providers are transitioning backbone technology to IP or IP over MPLS network technology, and are requesting virtual private network service to integrate two-layer services such as ATM and frame relay to IP backbone technology.

Meanwhile, the current virtual private network service is set in the following manner. First, a subscriber who wants a virtual private network service requests a manager of a service provider to set up a virtual private network service. Next, the administrator of the service provider configures a provider edge router or the like according to the required condition in accordance with the requested configuration service to build the requested virtual private network service.

However, the conventional method described above provides services centered on the network service provider. Therefore, regardless of the subscriber's intention, the above-mentioned conventional method must be used until termination of the allocated service, and a contract with the network service provider must be re-contracted in changing the service. It is not free to change the service because a cumbersome situation occurs. In addition, the network management cost for service provision is high in the case of a network service provider, when the service is frequently changed or deleted after providing the service.

The technical problem to be achieved by the present invention is to provide a service for exclusive use of a two-layer virtual private network in the MPLS network, a subscriber edge device, a provider edge device and a two-layer virtual device to automatically set up a virtual private network at the request of the subscriber. The present invention provides a method for setting up a private network service.

In order to achieve the above technical problem, the subscriber edge device according to the present invention transmits a message requesting the establishment of a virtual private network according to a user input to a provider edge device, and from the provider edge device. A UNI signal processor for receiving a first response message to the message; And a system controller configured to set a two-layer interface for the virtual private network according to the configuration information included in the received first response message.

In order to achieve the above technical problem, the provider edge device of the layer 2 virtual private network service according to the present invention receives a message requesting the establishment of the virtual private network service from the subscriber edge device, and based on the received message, A service allocator configured to determine virtual private network service information; And an MPLS controller configured to set an MPLS tunnel and a VC tunnel for the virtual private network according to the determined virtual private network service information.

According to another aspect of the present invention, there is provided a method of setting a two-layer virtual private network service according to the present invention. (A) transmitting a message requesting the establishment of a virtual private network according to a user input to a provider edge device; ; (b) receiving a first response message to the message from the provider edge device; And (c) controlling the setting of the layer 2 interface information for the virtual private network according to the configuration information included in the received first response message.

According to another aspect of the present invention, there is provided a method for configuring a layer 2 virtual private network service according to the present invention. (A) Receiving a message requesting the setting of a virtual private network service from a subscriber edge device, and based on the received message, Determining private network service information; And (b) performing MPLS tunnel establishment and VC tunnel establishment for the virtual private network according to the determined virtual private network service information.

Hereinafter, a method and an apparatus according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating the concept of a virtual private network.

Referring to FIG. 1, a network configuration for a virtual private network (hereinafter referred to as a VPN) service includes a provider edge (hereinafter referred to as PE) and a subscriber edge (hereinafter referred to as CE) and a pro. It is composed of a provider (hereinafter referred to as P).

Here, the PE refers to equipment located at the end of the provider network for providing the layer 2 service for the virtual private network service. In addition, CE refers to subscriber equipment connected to the PE to be serviced. Also, a device not related to virtual private network data is named P (Provider). In this virtual private network architecture, the service provides a dedicated private line from the CE interface of VPN site 1 to the CE interface of VPN site 2.

2 is a diagram illustrating a concept of tunneling for a virtual private network.

A tunnel is a forwarding tool like the one shown in Figure 2, where two devices can be connected directly when data is forwarded through a network from one device to another. That is, considering node B's data forwarding in node A through XYZ provider network, node A and node B set up tunnel in provider's network from node X to node Z to act as if they are directly connected. Then, the data received from node A is transmitted by adding the tunnel header, and the tunnel header is removed from the Z device, and then the data transmitted from node A is transmitted to node B, so that each node A and B of the customer equipment operates as if the dedicated line is directly connected. You can get it.

In order to provide MPLS-based two-layer Ethernet dedicated service, MPLS Label Switched Path (LSP) by RSVP or LDP should be set, and two-layer forwarding information exchange should be performed at each edge. As a Martini function, it uses the message exchange method by "draft-ietf-pwe3-control-protocol" .

3 is a diagram conceptually representing a virtual private network service. Referring to FIG. 3, the IP backbone network may be a provider network, which may be an IP network and also an IP over MPLS network. Therefore, in order to provide MPLS-based 2-layer Ethernet dedicated service, the provider network uses the MPLS tunnel by RSVP or LDP, and the LDP Martini protocol operates at each edge of the provider network to provide to the customer. Data forwarding is enabled by negotiating hierarchical information and setting up a forwarding table in each edge device so that data forwarding can be performed through an interface directly connected to each subscriber.

4A is a diagram illustrating a two-layer information negotiation process performed at each edge device. Referring to FIG. 4A, each edge device is exchanging data based on a protocol according to the LDP Martini function for layer 2 information negotiation.

4B is a diagram for explaining a data forwarding process performed in PE1 and PE2. After the protocol message exchange by the LDP Martini function is completed in the edge device as shown in FIG. 4A, a bidirectional forwarding table is set in each PE1 and PE2, and data forwarding is performed as shown in FIG. 4B.

FIG. 5 is a diagram illustrating a conventional two-layer virtual private dedicated service centered on a network service provider. The provider edge (PE) represents the edge equipment of the service provider network, the P (Provider) represents the intermediate equipment of the service provider network, and the customer edge (CE) represents the subscriber edge equipment provided with two-layer virtual private dedicated service. . To enable this service, an MPLS tunnel (LSP) is established by LDP or RSVP-TE between PE1 ↔ P ↔ PE2. Next, after the MPLS tunnel is created, a message exchange is performed between PE1 ↔ PE2 for connection of a two-layer virtual private service by LDP or GBP extension function, and the VC (Virtual Circuit) based on the messages exchanged for each PE1 and PE2. You will create a label-based tunnel. In this way, MPLS-based two-layer virtual private network dedicated service is provided to subscriber edge equipment.

However, as described above, since the existing method provides services centered on the network service provider, regardless of the subscriber's intention, the existing method must be used unconditionally until the terminated service is terminated. It is not free to change the service because a cumbersome situation occurs. In addition, even in the network service provider's point of view, if the change or deletion is frequently performed after providing the service, the network management cost for providing the service is high.

6 is a block diagram illustrating the configuration of subscriber edge equipment and provider edge equipment according to an embodiment of the present invention, and includes a subscriber edge equipment 600 and a provider edge equipment 610. The present invention will be described on the premise of a network providing MPLS-based two-layer virtual private network service to which subscriber edge equipment having a two-layer interface (Ethernet / Frame Relay / ATM) is connected. The subscriber edge device and the service provider edge device have UNI (User-Network Interface) signal processing units 622 and 642 for the automatic allocation of the layer 2 virtual private network service, and the existing UNI resources for the UNI signal processing function. Reservation protocol (RSVP) and UNI-LDP protocol can be extended and used, and new protocol or application can be developed and used.

The subscriber edge device 600 is generally configured as a router, and in order to request a virtual private network by the subscriber according to the present invention, the subscriber edge device 600 should further include a service request unit 620. The service request unit 620 includes a UNI signal processor 622 and a system controller 624.

Similarly, the provider edge device 610 is generally configured as a router. In addition to the existing router function, the service allocator 640 and the MPLS controller 630 may be used to set up a virtual private network by requesting a subscriber edge device according to the present invention. ) Should be included.

First, a specific signaling system must exist between the subscriber edge device 600 and the provider edge device 610, and a resource reservation protocol (hereinafter referred to as RSVP) for the existing user network interface (UN) and You can extend the LDP protocol, or you can implement a simple protocol or develop and use an application such as CORBA or RMI.

The UNI signal processing unit 622 transmits a message requesting the setting of the virtual private network service and a message requesting the release of the preset virtual private network service to the UNI signal processing unit 642 of the provider edge device 610. Receive a response message to the above-mentioned message from the UNI signal processor 642 of the equipment 610. In addition, according to the response message, the system controller 624 requests to set or delete the layer 2 interface information.

The service allocator 640 receives a message requesting the establishment of the virtual private network service from the subscriber edge device, and determines the virtual private network service information to be set based on the received message. The service allocator 640 includes a UNI signal processor 642, a two-layer interface manager 644, and a service information manager 646.

The UNI signal processor 642 receives a setup / release message of a virtual private network service from the UNI signal processor 622 of the subscriber edge device 600, and based on the received message, the remaining module, for example, the layer 2 interface manager 644. When the MPLS controller 630 performs a predetermined task, the MPLS controller 630 transmits a first response message and a second response message to the UNI signal processor 622 of the subscriber edge device 620.

The two-layer interface manager 644 manages the two-layer interface information to be set / deleted when the MPLS controller 630 establishes or releases the virtual private network service connection, and provides the information to the UNI signal processor 642. When the second layer interface management unit 644 determines whether the two-layer interface desired by the subscriber included in the message requesting the setting of the virtual private network service is available, and provides the determination result to the UNI signal processing unit 642, the UNI signal The processor 642 includes the determination result in the first response message and transmits the result to the UNI signal processor 622 of the subscriber edge device 620. The system controller 624 of the subscriber edge equipment 620 sets the two-layer interface of the subscriber edge equipment 600 according to the two-layer interface information included in the first response message.

The service information management unit 646 manages information on usage time and service capacity whenever a subscriber requests setting / deletion of a service, and according to the service usage information of the subscriber, the network service provider may use information such as time and capacity actually used by the subscriber. Based on the information, it provides basic data on the service cost calculation centered on subscribers.

The MPLS control unit 650 establishes an MPLS tunnel (LSP) for a two-layer virtual private service centered on an existing network service provider and a VC tunnel according to VC label exchange by LDP or BGP extension between each PE (Provider Edge). Perform the setting function.

7A is a diagram illustrating an operation flow by a request for setting up a virtual private network service according to an embodiment of the present invention.

Referring to FIG. 7A, the configuration request message includes a subscriber edge equipment address, a service provider edge equipment address, and an address of a subscriber edge equipment of a destination to be actually connected, for communication between UNI signal processing modules. In addition, the request message ID is included in the setup request message for the identifier of the setup information of the requested virtual private network service. An example of the method of allocating the request message ID is to allocate sequentially from the first, but not to duplicate the unique value. In addition, the setup request message includes the interface information that the subscriber wants to set. For example, the interface type and the two-layer information corresponding thereto are examples, and examples of the interface type include Ethernet, ATM, frame relay, and the like. The two-layer information includes VLanID value, VPI / VCI value, and DLCI according to each interface type. This is the value. In addition, the setup request message may include the quality information of the virtual private network service that the subscriber wants to set up. Examples of the quality information may include a capacity of 100 Mb and information of gold, silver, and bronze.

As described above, according to the setup request message, the provider edge device determines whether to set a predetermined virtual private network and performs an operation thereof, and then transmits a response message to the subscriber edge device. Here, examples of the contents included in the response message include various addresses, request message IDs, and virtual private network setting result information. The subscriber edge device identifies the requested virtual private network based on the request message ID and the subscriber edge equipment address included in the received response message, and includes in the received response message whether the setup of the identified virtual private network was successful or failed. It can be seen from the information whether the result of the virtual private network setup. If it is determined that the virtual private network setup is successful, the subscriber edge device may set the requested layer 2 interface information to prepare for data transmission using the virtual private network.

7B is a diagram illustrating an operation flow by a request for releasing a virtual private network service according to one embodiment of the present invention.

Referring to FIG. 7B, the release request message includes a subscriber edge equipment address, a service provider edge equipment address, an address of a subscriber edge equipment of a destination to be actually connected, and a request message ID. As described above, according to the setup request message, the provider edge device determines whether to release a predetermined virtual private network and performs an operation thereof, and then transmits a response message to the subscriber edge device. Here, examples of the contents included in the response message include various addresses, request message IDs, and virtual private network release result information. The subscriber edge device identifies the virtual private network requested to be released based on the request message ID included in the received response message and the subscriber edge equipment address, and determines whether the release of the identified virtual private network was successful or failed in the received response message. It can be seen from the included virtual private network release result information. If it is determined that the virtual private network release is successful, the subscriber edge device releases the set layer 2 interface information.

FIG. 8A is a diagram illustrating an operation and control of the service request unit 620 of the subscriber edge device 600 of FIG. 6. First, a subscriber operation command requesting service setting / release is required, and according to the command, the UNI signal processor 622 generates a corresponding message and transmits the message to the UNI signal processor 642 of the service provider edge device. In addition, the UNI signal processor 622 receives a response message for setting / release of a layer 2 private private service connection from the UNI signal processor 642 of the service provider edge device. In step 820, it is required to set or release the layer 2 interface. The system controller 820 may perform a function of setting forwarding information in the subscriber edge device, and sets the second layer information according to the response message indicating that the virtual private network is successfully set. Here, examples of the layer 2 information may include layer 2 interface and layer 2 channel information. For example, in case of Ethernet, information such as interface ID and VLanID is set, and in case of ATM, it means interface ID, VPI value, and VCI value. When the subscriber edge device transmits and receives data with the set interface ID, the subscriber edge device includes two-layer information in the two-layer data header to transmit and receive data.

FIG. 8B is a diagram illustrating operation and control of the provider edge equipment 610 of FIG. 6.

First, the UNI signal processing unit 642 receives the setting / release message from the UNI signal processing unit 622 of the subscriber edge device and receives the available layer 2 interface information from the layer 2 interface management unit 880 and sends it to the MPLS control unit 860. A request for connection to a two-layer virtual trimming dedicated service is performed, and the subscriber setting / release information is stored in the service information management unit 870. If the function of setting and deleting the service is normally received from the MPLS control unit 860, the service transmits a response message for setting / release to the UNI signal processing unit 622 of the subscriber edge device.

If the layer 2 interface manager 880 has also allocated whether the layer 2 information requested when the service configuration request message is received from the UNI signal processor 622 of the subscriber edge device is assignable, the layer 2 interface manager 880 is already allocated the next time the allocation request is received. If it is two-layer information, it manages possible two-layer interface information and allocated information in order to reject service allocation. Therefore, upon receiving the virtual private network service setup request message, the MPLS controller 860 determines whether it is requestable two-layer information before requesting the LSP setup and the two-layer virtual private network setup, and if possible, the MPLS controller 860. Performs LSP setup and layer 2 virtual private network setup request.

The service information management unit 870 stores the information that the subscriber sets up and releases the layer 2 based virtual private network based on the message requested from the subscriber, for example, subscriber IP, service start time, service end time, usage capacity, quality of use, and the like. The service provider can then verify the details of using the subscriber's virtual private network service. For example, when the service provider charges for the virtual private network service, the service price may be determined based on the subscriber information. For example, when the service start time is received from the MPLS controller 860 that the LSP setup and the layer 2 based virtual private network setup are completed, the service information manager 870 records the time as the service start time. Similarly, when the service release time is received from the MPLS control unit 860 that the virtual private network release is completed, this time is recorded as the service release time.

The MPLS controller 860 receives a request for the LSP and L2VPN setting / release from the UNI signal processor 642 of the provider edge device, and sets or releases the LSP and L2VPN accordingly. This is to use the function of the existing MPLS equipment as it is. In addition, all the forwarding information for the LSP and L2VPN is set by the MPLS controller 860.

9A is a flowchart illustrating an operation of subscriber edge equipment in a method for establishing a layer 2 virtual private network according to an embodiment of the present invention. It demonstrates with reference to FIG. The subscriber performs the setting / release command (S900), and if the setting command (S902) internally stores the setting request information and generates a setting request message (S904). In the case of the release command (S902), it is checked whether the previously requested information exists and generates a release request message (S906). The generated setup request message or release request message is transmitted to the UNI signal processor 642 of the service provider edge device (S908). After the step S908 or the step S910, the subscriber edge equipment waits until the response message arrives (S910).

When a response message is received from the service provider edge device (S912), it is determined whether the response message is a setup response message or a release response message (S914). First, if the response message for the setting (S914), it is confirmed whether the information requested previously (S916). If it is determined that the information has not been previously requested, and it is determined that the information has been previously requested (S916), a control message to be set is generated, and the system controller 644 requests the setting of the two-layer interface (S918). If it is a response message to the release request (S914), after confirming whether or not the previously requested information and deletes the information set internally, the system control unit 644 is required to delete the layer 2 interface (S922).

FIG. 9B is a flowchart illustrating the operation of a provider edge device in the layer 2 virtual private network setting method according to an embodiment of the present invention. After receiving a message for requesting setting / deletion from a service provider edge device, FIG. Shows the procedure to perform service automatic allocation function by subscriber request in establishing two-layer virtual private network service connection. It demonstrates with reference to FIG.

 First, if a message is received from the subscriber edge equipment by the UNI signal processor 642 (S940), and is a message requesting the establishment of a virtual private network service (S942), it is determined whether there is an error in the UNI signal processor 642. It is checked by (S944). If it is determined that there is an error (S944), an error response message is generated (S946). If it is determined that there is no error (S944), after receiving available layer 2 interface information from the layer 2 interface manager 644 (S948), the MPLS controller 650 requests a service connection (S950). After receiving the response message confirming that the setting is made from the MPLS control module, the virtual private network service setting request information of the subscriber is stored in the service information management unit 646 (S952), and a response message for the service setting request is generated. (S954). Next, a response message for the service setting is transmitted to the UNI signal processor 622 of the subscriber edge equipment by the UNI signal processor 642 (S956).

In addition, in the case of the release request message (S942), a message error check is performed (S958). Similarly, if there is an error (S958), an error response message is generated (S946), and then transmitted to the UNI signal processing unit 622 (S956). If there is no error (S958), it is checked whether it is a release message corresponding to the information that has previously requested the establishment of the virtual private network, and the interface information used by the layer 2 interface management unit 644 is released (S960). On the other hand, if it is determined that the message is not a release message corresponding to the information previously requested to set up the virtual private network, it may be added to the function to generate an error response message, and then transmit to the subscriber edge equipment. Next, the deletion of the virtual private network service is requested by the UNI signal processor 642 to the MPLS controller 650 (S962). In addition, the subscriber service deletion information is stored by the service information storage unit 646 (S964), which is helpful information for determining a subscriber-oriented two-layer virtual private network dedicated service cost later. Then, a response message to the service deletion request is generated by the UNI signal processor 642 (S966), and transmitted to the subscriber edge equipment (S968).

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Such a method and apparatus of the present invention have been described with reference to the embodiments shown in the drawings for clarity, but these are merely exemplary, and various modifications and equivalent other embodiments are possible to those skilled in the art. Will understand. Therefore, the true technical protection scope of the present invention will be defined by the appended claims.

According to the present invention, in the provision of MPLS-based two-layer virtual private dedicated service, it is possible to request and release a service centered on subscribers, and in the network, setting and releasing two-layer virtual private dedicated service according to a request and release signal of a subscriber can be performed. This can be done automatically, reducing the cost of managing the network for the service provider, and recording information about service usage time and usage so that better service delivery can be achieved by using the actual data requested by the subscriber in determining service costs. It can work.

Claims (18)

A UNI signal processor for transmitting a message requesting the establishment of a virtual private network to a provider edge device and receiving a first response message for the message from the provider edge device; And And a system controller for setting a two-layer interface for the virtual private network according to the configuration information included in the received first response message. The message requesting the establishment of the virtual private network, Subscriber edge device of a two-layer virtual private network service, characterized in that it comprises the two-layer interface information and service quality information of the virtual private network desired by the user. The method of claim 1, The UNI signal processing unit transmits a message requesting the release of the virtual private network service to the provider edge device, and receives a second response message for the release request message from the provider edge device. And the system controller controls to release the set 2 tier interface information according to the release information included in the received second response message. A service allocator configured to receive a message requesting the establishment of a virtual private network service from a subscriber edge device and to determine virtual private network service information to be set based on the received message; And And a MPLS control unit configured to perform MPLS tunnel setup and VC tunnel setup for the virtual private network according to the determined virtual private network service information. The method of claim 4, wherein the virtual private network service information to be set includes: A provider edge device of a layer 2 virtual private network service, comprising: layer 2 interface information to be used in the virtual private network and service quality information to be supported by the virtual private network service. The method of claim 4, wherein the service allocation unit, A UNI signal processor for receiving a message requesting the establishment of the virtual private network service from the subscriber edge device; And And a two-layer interface manager configured to determine whether the two-layer interface included in the received message is available, and to set the two-layer interface according to the determination result. The method of claim 6, wherein the UNI signal processing unit, The provider edge device of the layer 2 virtual private network service, characterized in that for transmitting a message about the layer interface information according to the determination result of the layer interface management unit to the subscriber edge device. The method of claim 4, wherein the service allocation unit, A two-layer virtual private network service, comprising: a service information manager configured to manage service information including at least one of a usage time, a service capacity, and a service quality of the virtual private network service set according to the message requesting the setting of the virtual private network; Provider edge device. The method of claim 4, wherein The service allocator receives a message requesting release of a virtual private network service from the subscriber edge device, and determines information of the virtual private network to release based on the received message. And the MPLS controller releases the set tunnel according to the determined information of the virtual private network. (a) transmitting a message requesting the establishment of a virtual private network to a provider edge device; (b) receiving a first response message to the message from the provider edge device; And (c) controlling the setting of the layer 2 interface information for the virtual private network according to the setting information included in the received first response message. The method of claim 10, wherein the message for requesting the establishment of the virtual private network, And a layer 2 interface information and a quality of service information of the virtual private network desired by the user. The method of claim 10, (d) sending a message requesting the release of the virtual private network service to the provider edge device; (e) receiving a second response message for the release request message from the provider edge device; And (f) releasing the set layer 2 interface information according to the release information included in the received second response message. (a) receiving a message requesting establishment of a virtual private network service from a subscriber edge device, and determining virtual private network service information to be set based on the received message; And and (b) performing the MPLS tunnel setup and the VC tunnel setup for the virtual private network according to the determined virtual private network service information. The virtual private network service information to be set comprises: And a layer 2 interface information to be used in the virtual private network and service quality information to be supported by the virtual private network service. The method of claim 12, wherein step (a) comprises: (a1) receiving a message requesting the establishment of the virtual private network service from the subscriber edge device; And (a2) determining whether the layer 2 interface included in the received message is available, and setting the layer 2 interface according to the determination result. The method of claim 14, wherein step (a) is and (a3) transmitting a message regarding the layer 2 interface information to the subscriber edge device according to the determination result of the layer 2 interface manager. The method of claim 12, wherein step (a) comprises: And managing service information including at least one of a usage time, a service capacity, and a service quality of the set virtual service according to the message requesting the setting of the virtual private network. The method of claim 12, (c) receiving a message requesting release of a virtual private network service from the subscriber edge device; (d) determining, based on the received message, information of the virtual private network to release; And and (e) releasing the established tunnel in accordance with the determined information of the virtual private network.

Images